batman_adv: batadv0: Removing interface: batadv_slave_0
==================================================================
batman_adv: batadv0: Interface deactivated: batadv_slave_1
batman_adv: batadv0: Removing interface: batadv_slave_1
BUG: KASAN: null-ptr-deref on address           (null)
Read of size 24 by task kworker/u4:5/3573
CPU: 1 PID: 3573 Comm: kworker/u4:5 Not tainted 4.7.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_send_outstanding_bat_ogm_packet
 0000000000000000 ffff8800af1cf9e8 ffffffff82e4a282 0000000000000018
 ffff8800af1cfa78 ffff8800ab3b6380 ffff8800a8e63350 0000000000000024
 ffff8800af1cfa68 ffffffff81745ef5 0000000000000003 ffff8800ab3b6380
Call Trace:
 [<ffffffff82e4a282>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff82e4a282>] dump_stack+0x136/0x1d4 lib/dump_stack.c:51
 [<ffffffff81745ef5>] kasan_report_error+0x485/0x5b0 mm/kasan/report.c:273
 [<ffffffff81746354>] kasan_report+0x34/0x40 mm/kasan/report.c:298
 [<ffffffff81744d0d>] check_memory_region_inline mm/kasan/kasan.c:285 [inline]
 [<ffffffff81744d0d>] check_memory_region+0x13d/0x1a0 mm/kasan/kasan.c:299
 [<ffffffff81745183>] memcpy+0x23/0x50 mm/kasan/kasan.c:334
 [<ffffffff85cfab68>] batadv_tvlv_realloc_packet_buff net/batman-adv/main.c:891 [inline]
 [<ffffffff85cfab68>] batadv_tvlv_container_ogm_append+0x158/0x470 net/batman-adv/main.c:926
 [<ffffffff85cce0ea>] batadv_iv_ogm_schedule+0x9ea/0xc70 net/batman-adv/bat_iv_ogm.c:947
 [<ffffffff85d1a271>] batadv_schedule_bat_ogm net/batman-adv/send.c:448 [inline]
 [<ffffffff85d1a271>] batadv_send_outstanding_bat_ogm_packet+0x2f1/0x410 net/batman-adv/send.c:636
 [<ffffffff8138bf1c>] process_one_work+0x67c/0x14f0 kernel/workqueue.c:2096
 [<ffffffff8138ce6a>] worker_thread+0xda/0xf10 kernel/workqueue.c:2230
 [<ffffffff8139d919>] kthread+0x209/0x2d0 kernel/kthread.c:209
 [<ffffffff85e0a64f>] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:389
==================================================================
BUG: unable to handle kernel NULL pointer dereference at           (null)
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
IP: [<ffffffff82e7b1c6>] memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:51
PGD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 3573 Comm: kworker/u4:5 Tainted: G    B           4.7.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_send_outstanding_bat_ogm_packet
task: ffff8800ab3b6380 ti: ffff8800af1c8000 task.ti: ffff8800af1c8000
RIP: 0010:[<ffffffff82e7b1c6>]  [<ffffffff82e7b1c6>] memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:51
RSP: 0018:ffff8800af1cfac8  EFLAGS: 00010246
RAX: ffff880128e21800 RBX: 0000000000000018 RCX: 0000000000000018
RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffff880128e21800
RBP: ffff8800af1cfae8 R08: ffffed00251c4303 R09: ffffed00251c4303
R10: 0000000000000003 R11: ffffed00251c4302 R12: ffff880128e21800
R13: 0000000000000000 R14: ffff8800a8e63350 R15: 0000000000000024
FS:  0000000000000000(0000) GS:ffff88012c100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000127cb3000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff817451a5 0000000000000018 ffff8800b7015340 ffff8800a8e63348
 ffff8800af1cfb48 ffffffff85cfab68 ffff8800b7015b20 0000000000000000
 ffff880128e21800 ffff88000000003c ffff8800b7015b30 ffff8800b7015340
Call Trace:
 [<ffffffff85cfab68>] batadv_tvlv_realloc_packet_buff net/batman-adv/main.c:891 [inline]
 [<ffffffff85cfab68>] batadv_tvlv_container_ogm_append+0x158/0x470 net/batman-adv/main.c:926
 [<ffffffff85cce0ea>] batadv_iv_ogm_schedule+0x9ea/0xc70 net/batman-adv/bat_iv_ogm.c:947
 [<ffffffff85d1a271>] batadv_schedule_bat_ogm net/batman-adv/send.c:448 [inline]
 [<ffffffff85d1a271>] batadv_send_outstanding_bat_ogm_packet+0x2f1/0x410 net/batman-adv/send.c:636
 [<ffffffff8138bf1c>] process_one_work+0x67c/0x14f0 kernel/workqueue.c:2096
 [<ffffffff8138ce6a>] worker_thread+0xda/0xf10 kernel/workqueue.c:2230
 [<ffffffff8139d919>] kthread+0x209/0x2d0 kernel/kthread.c:209
 [<ffffffff85e0a64f>] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:389
Code: ff ff ff 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 
RIP  [<ffffffff82e7b1c6>] memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:50
 RSP <ffff8800af1cfac8>
CR2: 0000000000000000
---[ end trace 921a716467ffd295 ]---